Vidar Infostealer via Fake GTA 6 Lures, HookBot/ERMAC Leak Fallout & RecruitTrap OAuth Phishing: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Threat Summary

Four concurrent OTX pulses paint a single, coherent picture: credential and session-token theft is the dominant enterprise threat vector this cycle, and the delivery surface has fragmented across consumer gaming lures, mobile banking malware-as-a-service, AI-generated malware tooling, and recruitment-themed OAuth phishing.

The attack chains observed in these pulses:

Fake GTA 6 "Extended Look" / demo sites — SEO-poisoned and search-ad-driven sites impersonating Rockstar Games push gta6_installer.exe, which is a Vidar infostealer. Vidar exfiltrates browser credentials, cookies, session tokens, crypto wallets, and system metadata over HTTP/S to actor-controlled C2 (the 1001gacor.org, sm188daftar.mom, 11gokil.org clusters) before self-terminating and deleting its binary. Employees downloading this on corporate or BYOD devices hand over enterprise SSO sessions and stored SaaS credentials.
HookBot / ERMAC source leak (DukeEugene lineage) — the August 2025 leak of the ERMAC/HookBot builder, Laravel backend, and React panel has enabled unrelated operators to stand up Android banking trojan panels, some still running with default credentials and hardcoded keys intact. The lineage Cerberus → BlackRock → ERMAC → Hook/Xerxes means the panel IoCs (185.99.255.17, 93.127.141.93, 45.207.206.169, 212.193.23.223, 118.107.45.x) are actively reusable detection targets. Financial-sector targeting is confirmed.
AI-enabled malware proliferation — Unit 42's analysis of 405 AI-integrated samples shows the threat is maturing: while ~97% remain PoC, 12 samples (FunkSec ransomware, Oyster backdoor, Rhadamanthys stealer, CleanBoost, RecipeLister) reached real endpoints in three countries. LLM-generated loaders are lowering the barrier for stealer/RAT deployment.
RecruitTrap — recruitment-themed phishing impersonating HR at major brands (McKinsey, American Airlines, Levi's, Expedia, HBC, FIFA), using Browser-in-the-Browser (BitB) on desktop and full-screen fake login pages on mobile. The infrastructure rejects personal email domains, screening specifically for corporate credentials and OAuth tokens across aerospace, tech, retail, finance, hospitality, manufacturing, and media.

Collective objective: harvest enterprise credentials, OAuth tokens, and session cookies at scale — the raw material sold and traded on dark web credential markets (Russian Market, Exodus, Genesis successors) and consumed by initial access brokers for ransomware and BEC intrusions.

Threat Actor / Malware Profile

Vidar Infostealer (GTA 6 lure campaign)

Distribution: SEO poisoning + malvertising against "GTA 6 demo / Extended Look" queries; fake Rockstar-branded landing pages; gta6_installer.exe payload.
Payload behavior: On execution, Vidar (C/C++, often delivered via a loader stage) profiles the host (machine GUID, OS, GPU/CPU, running processes), then rips data from Chromium/Gecko browsers — Login Data, Cookies, Web Data, autofill — plus Discord/Telegram tokens and ~20 crypto wallet extensions.
C2 communication: HTTPS POST to panel endpoints; Vidar panels commonly exfiltrate a ZIP archive of stolen data; secondary C2 via public dead-drop services (Steam profiles, Telegram) to retrieve real panel URLs. The .1001gacor.org subdomains and sm188dnsx.top/11gokil.org hosts represent this C2/staging tier.
Persistence: None by design — Vidar is "steal and die," self-deleting via spawned cmd.exe after exfiltration. Detection must catch the execution window.
Anti-analysis: VM/sandbox checks, string obfuscation, in-memory decryption of C2 config, mutex checks against duplicate execution.

HookBot / ERMAC (DukeEugene ecosystem)

Distribution: Sold as malware-as-a-service; smishing and overlay-injected droppers push the Android APK. Post-leak, anyone can deploy the builder + Laravel backend + React panel.
Payload behavior: Android banking trojan — overlay attacks over banking/crypto wallet apps, Accessibility-abuse keylogging, SMS interception (2FA theft), VNC/remote control (Hook), contact-list exfiltration for smishing propagation.
C2 communication: HTTPS beaconing to panel infrastructure (the IPv4 IoCs above); panel admin over exposed web interfaces — critically, leaked panels ship with default admin credentials and static AES keys, making C2 traffic fingerprintable.
Anti-analysis: Emulator detection, Accessibility service abuse to block uninstall, junk-code obfuscation from the leaked builder.

RecruitTrap (no malware — pure social engineering)

Delivery: SMS/LinkedIn/WhatsApp recruiting lures → fake *-careers.com portals.
Technique: Browser-in-the-Browser fake SSO windows on desktop; on mobile, full-screen credential pages with no visible URL bar. Victim screening rejects consumer webmail — only corporate domains proceed, maximizing enterprise OAuth/token yield.

AI-enabled families (Oyster, Rhadamanthys, FunkSec)

LLM-assisted loaders and COM-hijacking PoCs; Rhadamanthys continues as a tier-1 stealer with frequent config rotation — the SHA256 set in the pulse should be retro-hunted across the last 90 days.

IOC Analysis

The indicator set spans four operational types:

Hostnames/domains (*.1001gacor.org, zaf.11gokil.org, ket.sm188daftar.mom): Vidar C2/staging. Pattern: throwaway TLDs (.org, .mom, .top) with high-entropy subdomains and gambling-themed parent domains — strong passive-DNS clustering signal. Sinkhole or block at DNS; alert on any resolution.
Careers-impersonation domains (mckinsey-careers.com, hbc-careers.com, etc.): RecruitTrap phishing. Note careers.com in the IoC list — validate before bulk-blocking; the legitimate careers.com domain must be allowlisted to avoid self-inflicted outage. Block the brand-hyphenated pattern set and hunt web proxy/email logs.
IPv4s (185.99.255.17, 93.127.141.93, 45.207.206.169, 212.193.23.223, 118.107.45.29/73): HookBot/ERMAC panel hosts. Feed to egress firewall and EDR network blocks; run retro NetFlow/proxy hunts for 90 days.
SHA256 hashes (12 AI-malware samples): import into EDR blocklists and retro-hunt; several are research-stage, so treat detections as high-fidelity but low-volume.

Operationalization tooling: bulk-import IoCs via your TIP (MISP/OpenCTI/STIX-TAXII feed from OTX), decode and pivot with CyberChef for obfuscated configs, enrich domains with VirusTotal/passive DNS (DomainTools, SecurityTrails), and use URLScan.io to fingerprint the fake GTA 6 and careers portals. OTX pulses themselves export directly to most SIEM/EDR platforms via the OTX DirectConnect API.

Detection Engineering

YAML

---
title: Vidar Infostealer Execution via Fake Game Installer
description: Detects execution of the gta6_installer.exe Vidar payload and typical Vidar behavior - browser credential store access followed by self-deletion via cmd.exe
status: experimental
logsource:
    category: process_creation
    product: windows
author: Security Arsenal Threat Intel
date: 2026/08/25
references:
    - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer
detection:
    selection_installer:
        Image|endswith: 'gta6_installer.exe'
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
    selection_browser_theft:
        CommandLine|contains:
            - 'Login Data'
            - 'Local State'
            - '\Cookies'
            - 'Web Data'
    selection_selfdelete:
        ParentCommandLine|contains: 'gta6_installer'
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - '/c del'
            - 'timeout'
    condition: selection_installer or (selection_browser_theft and not 1 of filter_legit*) or selection_selfdelete
falsepositives:
    - Legitimate software updaters reading browser data (rare)
level: high
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1070.004
---
title: Suspicious Network Connection to Vidar or HookBot C2 Infrastructure
description: Detects outbound connections to known Vidar infostealer C2 hostnames and HookBot/ERMAC panel IP addresses from the OTX pulses of 2026-08-25
status: experimental
logsource:
    category: network_connection
    product: windows
author: Security Arsenal Threat Intel
date: 2026/08/25
detection:
    selection_domain:
        DestinationHostname|contains:
            - '1001gacor.org'
            - 'sm188daftar.mom'
            - 'sm188dnsx.top'
            - '11gokil.org'
            - 'yeyr.lol'
            - 'havijmail.com'
    selection_ip:
        DestinationIp:
            - '185.99.255.17'
            - '93.127.141.93'
            - '45.207.206.169'
            - '212.193.23.223'
            - '118.107.45.73'
            - '118.107.45.29'
    filter_legit:
        Image|endswith:
            - '\svchost.exe'
    condition: (selection_domain or selection_ip) and not filter_legit
falsepositives:
    - Security researchers and sandboxes
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: RecruitTrap Phishing Domain Resolution or OAuth Token Theft Attempt
description: Detects DNS resolution or process access to RecruitTrap recruitment-phishing infrastructure impersonating corporate HR portals
status: experimental
logsource:
    category: dns_query
    product: windows
author: Security Arsenal Threat Intel
date: 2026/08/25
detection:
    selection:
        query|contains:
            - 'hbc-careers.com'
            - 'fifahr-careers.com'
            - 'mckinsey-careers.com'
            - 'aa-careers.com'
            - 'levis-careers.com'
            - 'expedia-careers.com'
            - 'andmore-global.com'
    condition: selection
falsepositives:
    - Threat hunting and security research activity
level: high
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1557

KQL — Microsoft Sentinel / Defender

// RecruitTrap + Vidar + HookBot IOC and behavior hunt — Microsoft Sentinel
// Run over the last 30 days; extend to 90d for retro-hunt
let VidarC2 = dynamic(["1001gacor.org","sm188daftar.mom","sm188dnsx.top","11gokil.org","yeyr.lol","havijmail.com"]);
let HookPanelIPs = dynamic(["185.99.255.17","93.127.141.93","45.207.206.169","212.193.23.223","118.107.45.73","118.107.45.29"]);
let RecruitTrap = dynamic(["hbc-careers.com","fifahr-careers.com","mckinsey-careers.com","aa-careers.com","levis-careers.com","expedia-careers.com","andmore-global.com"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (VidarC2) or RemoteUrl has_any (RecruitTrap) or RemoteIP in (HookPanelIPs)
| extend Campaign = case(
    RemoteUrl has_any (VidarC2), "Vidar C2",
    RemoteUrl has_any (RecruitTrap), "RecruitTrap Phishing",
    "HookBot/ERMAC Panel")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, Campaign;
let ProcHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "gta6_installer.exe"
   or (ProcessCommandLine has_any ("Login Data","Local State","Web Data")
       and InitiatingProcessFileName !in~ ("msedge.exe","chrome.exe"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
union NetHits, ProcHits
| sort by TimeGenerated desc

PowerShell

# Security Arsenal - Vidar/HookBot/RecruitTrap IOC hunt script
# Run elevated on suspected endpoints or via your RMM/EDR live response
param([switch]$ExportCsv)

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

$badDomains = @('1001gacor.org','sm188daftar.mom','sm188dnsx.top','11gokil.org',
                'yeyr.lol','havijmail.com','hbc-careers.com','fifahr-careers.com',
                'mckinsey-careers.com','aa-careers.com','levis-careers.com',
                'expedia-careers.com','andmore-global.com')
$badIPs = @('185.99.255.17','93.127.141.93','45.207.206.169',
            '212.193.23.223','118.107.45.73','118.107.45.29')

Write-Host "[*] Checking active/established network connections against C2 IoCs..."
Get-NetTCPConnection -State Established | ForEach-Object {
    $ip = $_.RemoteAddress
    if ($badIPs -contains $ip) {
        $proc = Get-Process -Id $_.OwningProcess
        $findings += [pscustomobject]@{
            Type='NetworkIoC'; Indicator=$ip
            Detail="Process: $($proc.ProcessName) (PID $($_.OwningProcess)) Path: $($proc.Path)"
        }
    }
}

Write-Host "[*] Checking DNS client cache for stealer/phishing domains..."
Get-DnsClientCache | ForEach-Object {
    foreach ($d in $badDomains) {
        if ($_.Entry -like "*$d*") {
            $findings += [pscustomobject]@{Type='DnsCache'; Indicator=$_.Entry; Detail="Data: $($_.Data)"}
        }
    }
}

Write-Host "[*] Hunting for gta6_installer.exe and Vidar staging artifacts..."
$paths = @("$env:TEMP","$env:USERPROFILE\Downloads","$env:LOCALAPPDATA\Temp","C:\Users\Public\Downloads")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -Force -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -match 'gta6|gta_?vi|install(er)?\.exe$|vidar' } |
        ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
            $findings += [pscustomobject]@{Type='FileArtifact'; Indicator=$_.FullName; Detail="SHA256: $h"}
        }
}

Write-Host "[*] Checking for browser credential-store access artifacts (prefetch)..."
Get-ChildItem 'C:\Windows\Prefetch' -Filter '*.pf' -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and $_.Name -notmatch 'CHROME|MSEDGE|FIREFOX' } |
    ForEach-Object { $null = $_ } # triage manually if needed

Write-Host "[*] Checking scheduled tasks and Run keys for stealer persistence/droppers..."
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'Temp|AppData|Public' } |
    ForEach-Object { $findings += [pscustomobject]@{Type='Persistence-Task'; Indicator=$_.TaskName; Detail=$_.Actions.Execute} }
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
                 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
    ForEach-Object { $_.PSObject.Properties } |
    Where-Object { $_.Value -match 'Temp|AppData\\Local\\Temp' } |
    ForEach-Object { $findings += [pscustomobject]@{Type='Persistence-RunKey'; Indicator=$_.Name; Detail=$_.Value} }

if ($findings.Count -gt 0) {
    Write-Host "[!] $($findings.Count) suspicious findings:" -ForegroundColor Red
    $findings | Format-Table -AutoSize
    if ($ExportCsv) { $findings | Export-Csv -Path ".\iocs_findings_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation }
} else {
    Write-Host "[+] No IOC matches found on $env:COMPUTERNAME" -ForegroundColor Green
}

Response Priorities

Immediate (0–4 hours)

Block all listed hostnames, domains, and panel IPs at DNS, web proxy, and egress firewall. Allowlist the legitimate careers.com before pattern-blocking RecruitTrap domains.
Push the 12 SHA256 hashes to EDR blocklists and trigger retro-hunts (Sentinel KQL above, minimum 30 days).
Hunt for gta6_installer.exe execution and any browser-data access by non-browser processes; isolate any endpoint with a Vidar C2 connection.
Flag any inbound mail/SMS referencing the impersonated career portals; purge matching messages tenant-wide.

Within 24 hours

Assume credential compromise on any Vidar hit: Vidar exfiltrates in seconds. Force password resets and — more critically — revoke all session tokens/OAuth grants for affected users (Entra ID / Okta sign-out everywhere, revoke refresh tokens). Cookies are the real prize; password resets alone are insufficient.
Review SaaS audit logs (M365, Google Workspace, IdP) for anomalous session reuse from unusual ASN/geography for impacted users.
For RecruitTrap exposure: identify users who visited the fake portals (proxy/DNS logs), reset their credentials, revoke OAuth consents, and check for newly registered MFA devices or forwarding rules.
Financial-sector orgs: brief mobile fleet owners on HookBot/ERMAC overlay risk; audit Android devices for unknown Accessibility-service grants.

Within 1 week

Architecture hardening against the actual vectors:
- Enforce phishing-resistant MFA (FIDO2/passkeys) — RecruitTrap's BitB and token theft specifically defeats SMS/TOTP push-based flows.
- Deploy browser isolation or block-by-default for newly registered/uncategorized domains (all four campaigns rely on fresh throwaway domains).
- Restrict browser credential-store access via EDR tamper rules; consider disabling password sync in browsers and moving users to a managed vault.
- Implement OAuth app consent policies (admin-consent workflow) to cut off token-theft monetization.
- Mobile: enforce MTD (e.g., Zimperium-class) on BYOD and block sideloaded APKs via MDM.
- Subscribe your SIEM/TIP to the relevant OTX pulses for continuous IoC refresh — these panels rotate weekly.